UNKNOWN NVD
CVE-2026-109553
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user
Gitea resolved the principals of an SSH certificate by searching the content of all stored public keys instead of only principal keys. When Gitea trusts a user certificate authority (`SSH_TRUSTED_USER_CA_KEYS`) and accepts arbitrary principals (`SSH_AUTHORIZED_PRINCIPALS_ALLOW=anything`), a user could register another user's public key line as their own principal, or a holder of a certificate signed by that authority could list it, and then authenticate as the owner of that key through the HTTP signature API and the built-in SSH server. Instances that do not trust a user certificate authority are not affected.
References
- https://blog.gitea.com/release-of-28.2.0/
- https://github.com/go-gitea/gitea/pull/39839
- https://github.com/go-gitea/gitea/pull/39847
- https://github.com/go-gitea/gitea/releases/tag/v28.2.0
- https://github.com/go-gitea/gitea/security/advisories/GHSA-vcp6-2qc6-gvq3
This unknown severity vulnerability was published on 2026-10-18 via NVD.
vulnfeed aggregates 17240 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.